Dashboards & Visualizations

Is there any easy way to keep the colors for the same SQL statements/hashes between the two panels?

damucka
Builder

Hello,

We have several cases, where we relate the data between panels. On the example screenshots below, we have:

1/ Chart with the number of database threads in time, and the sum of threads per time unit involved in the execution of the particular SQL statement (SQL hash) - represented by the different colors: 

damucka_0-1647866824639.png

 

2/ Pie chart showing the portion of the particular SQL statement / hash in the given time span:

damucka_1-1647866847390.png

Is there any easy way to keep the colors for the same SQL statements/hashes between the two panels?

Kind Regards, Kamil

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Apply some sort of sort so that the series (names) are in the same order.

View solution in original post

0 Karma

damucka
Builder

Unfortunately even after sorting both the same order, see the screenshot below, the colors assigned to both panels are different:

damucka_0-1647870229728.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's because they aren't sorted in the same order (you can see that from the legends) - how have you done the sorting?

0 Karma

damucka
Builder

You are right of course.

I managed to match it, but now the issue is, that the stacked column chart displays like 9 different SQL hashes + others and the pie chart way more of them + others. The not quite nice consequence is, that the color for "others" does not match.

Would you know a chart option for both, stacked column and pie chart to restrict the number of displayed values say to 7 + "others"?

I could not find it in the visualization options, so I guess this is some more advanced parameter I would use in the xml.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Probably the way to do this is to implement the "other" stat as part of the SPL, that way you have control - so long as it was under the number of series supported by the pie chart.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apply some sort of sort so that the series (names) are in the same order.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...